CVE-2010-5284

EUVD-2010-5243
Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php, (2) y parameter in a newcal action to manageajax.php, and the (3) pic parameter to thumb.php.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
o-dyncollabtive
0.6.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
collabtive
hardy
dne
lucid
dne
oneiric
Fixed 0.7-1.1
released
precise
Fixed 0.7-1.1
released
quantal
Fixed 0.7.6-1
released
Common Weakness Enumeration
References
http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt
http://secunia.com/advisories/41805
http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt
http://www.exploit-db.com/exploits/15240
http://www.securityfocus.com/bid/44050
http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt
http://secunia.com/advisories/41805
http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt
http://www.exploit-db.com/exploits/15240
http://www.securityfocus.com/bid/44050